CVE-2018-15716

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

18.50%

Published

Nov 30, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index Exploit-DBNUUO NVRMini2 3.9.1 - (Authenticated) Command Injection

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS commands as root.

Weaknesses (CWE)

CWE-78CWE-78

Affected Products (5)

nuuo · nvrmini2_firmwarevulnerable

nuuo · ne-2020

nuuo · ne-2040

nuuo · ne-4080

nuuo · ne-4160

References (8)

http://www.securityfocus.com/bid/106059

Third Party AdvisoryVDB Entry

https://github.com/tenable/poc/tree/master/nuuo/nvrmini2/cve_2018_15716

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/45948/

ExploitThird Party AdvisoryVDB Entry

https://www.tenable.com/security/research/tra-2018-41

ExploitThird Party Advisory

http://www.securityfocus.com/bid/106059

Third Party AdvisoryVDB Entry

https://github.com/tenable/poc/tree/master/nuuo/nvrmini2/cve_2018_15716

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/45948/

ExploitThird Party AdvisoryVDB Entry

https://www.tenable.com/security/research/tra-2018-41

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs